Node.js Security Bug Bounty Program Paused Due to Funding Issues

Pause of the Bounty Program

The Node.js project's security bug bounty program, active since 2016, has been halted due to the lack of external funding. It was previously supported by the Internet Bug Bounty (IBB) program through a pooled funding approach via HackerOne.

The decision to pause the program comes as the IBB has also been paused, affecting monetary incentives for security researchers.

Impact on Security Practices

Despite the lack of funding for financial incentives, the Node.js Security Team maintains its commitment to security. They continue to accept and triage vulnerability reports through HackerOne, emphasizing the importance of responsible vulnerability disclosure on the health of the open-source ecosystem.

Researchers are encouraged to report security issues but will no longer receive bug bounty payouts. Node.js hopes the community will continue to prioritize security reporting.

Future of the Bounty Program

The Node.js project expressed gratitude towards security researchers who have contributed to the program, highlighting their role in enhancing the security of Node.js for millions of users.

The team indicates a willingness to reassess the bounty program's continuation if dedicated funding becomes available again and invites organizations interested in sponsoring to reach out.